Information disclosure in Debian Linux

1) Information disclosure

EUVDB-ID: #VU34902

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-18179

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn't have permissions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Debian Linux: 8.0

CPE2.3

• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

External links

https://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
https://community.otrs.com/security-advisory-2019-14-security-update-for-otrs-framework/
https://lists.debian.org/debian-lts-announce/2020/01/msg00000.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.